From fa9643666128a8ed60e22d4e0fa56e8638726d23 Mon Sep 17 00:00:00 2001
From: Yang Tse <yangsita@gmail.com>
Date: Thu, 12 Mar 2009 13:18:25 +0000
Subject: [PATCH] Fix TELNET transfers not being aborted upon write callback
 failures

---
 CHANGES       |  6 ++++++
 RELEASE-NOTES |  1 +
 lib/telnet.c  | 36 ++++++++++++++++++++++++++----------
 3 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index 682a03f51..469403364 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,12 @@
 
                                   Changelog
 
+Yang Tse (12 Mar 2009)
+- Added missing Curl_read() return code checking in TELNET transfers.
+
+- Pierre Brico found and fixed TELNET transfers not being aborted upon
+  a write callback failure.
+
 Daniel Stenberg (11 Mar 2009)
 - Kamil Dudka made the curl tool properly call curl_global_init() before any
   other libcurl function.
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 7709d97f8..f8e97a528 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -19,6 +19,7 @@ This release includes the following bugfixes:
  o an alloc-related call in the OpenSSL-using code didn't check the return value
  o curl_easy_duphandle() failed to duplicate cookies at times
  o missing TELNET timeout support in Windows builds
+ o missing Curl_read() and write callback result checking in TELNET transfers
 
 This release includes the following known bugs:
 
diff --git a/lib/telnet.c b/lib/telnet.c
index 109e081d8..69d42bd7f 100644
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -108,9 +108,9 @@ static CURLcode check_wsock2 ( struct SessionHandle *data );
 #endif
 
 static
-void telrcv(struct connectdata *,
-            const unsigned char *inbuf, /* Data received from socket */
-            ssize_t count);             /* Number of bytes received */
+CURLcode telrcv(struct connectdata *,
+                const unsigned char *inbuf, /* Data received from socket */
+                ssize_t count);             /* Number of bytes received */
 
 #ifndef CURL_DISABLE_VERBOSE_STRINGS
 static void printoption(struct SessionHandle *data,
@@ -952,19 +952,26 @@ static void suboption(struct connectdata *conn)
 }
 
 static
-void telrcv(struct connectdata *conn,
-            const unsigned char *inbuf, /* Data received from socket */
-            ssize_t count)              /* Number of bytes received */
+CURLcode telrcv(struct connectdata *conn,
+                const unsigned char *inbuf, /* Data received from socket */
+                ssize_t count)              /* Number of bytes received */
 {
   unsigned char c;
+  CURLcode result;
   int in = 0;
   int startwrite=-1;
   struct SessionHandle *data = conn->data;
   struct TELNET *tn = (struct TELNET *)data->state.proto.telnet;
 
 #define startskipping() \
-    if(startwrite >= 0) \
-       Curl_client_write(conn, CLIENTWRITE_BODY, (char *)&inbuf[startwrite], in-startwrite); \
+    if(startwrite >= 0) { \
+       result = Curl_client_write(conn, \
+                                  CLIENTWRITE_BODY, \
+                                  (char *)&inbuf[startwrite], \
+                                  in-startwrite); \
+      if(result != CURLE_OK) \
+        return result; \
+    } \
     startwrite = -1
 
 #define writebyte() \
@@ -1119,6 +1126,7 @@ void telrcv(struct connectdata *conn,
     ++in;
   }
   bufferflush();
+  return CURLE_OK;
 }
 
 /* Escape and send a telnet data block */
@@ -1389,7 +1397,11 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
           break;
         }
 
-        telrcv(conn, (unsigned char *)buf, nread);
+        code = telrcv(conn, (unsigned char *)buf, nread);
+        if(code) {
+          keepon = FALSE;
+          break;
+        }
 
         fflush(stdout);
 
@@ -1475,7 +1487,11 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
           break;
         }
 
-        telrcv(conn, (unsigned char *)buf, nread);
+        code = telrcv(conn, (unsigned char *)buf, nread);
+        if(code) {
+          keepon = FALSE;
+          break;
+        }
 
         /* Negotiate if the peer has started negotiating,
            otherwise don't. We don't want to speak telnet with